I has a problem with tproxy4 on linux kernel 2.6.24.7 the connection to a server(172.16.100.232) with foreign address(10.0.3.232) get long time(3 seconds) because a syn packet re-sent by tproxy server. (syn retry time may be 3-seconds) (first web server syn-ack packet may be ignored by tproxy.) what I do for this problem? below is the result of server-side tcpdump . tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth3, link-type EN10MB (Ethernet), capture size 96 bytes 22:23:45.739972 IP 10.0.3.232.3845 > 172.16.100.142.http: S 3133342350:3133342350(0) win 5840 <mss 1460,sackOK,timestamp 4475642 0,nop,wscale 9> 22:23:45.744947 IP 172.16.100.142.http > 10.0.3.232.3845: S 1184231461:1184231461(0) ack 3133342351 win 5792 <mss 1460,sackOK,timestamp 184168973 4475642,nop,wscale 7> 22:23:48.740436 IP 10.0.3.232.3845 > 172.16.100.142.http: S 3133342350:3133342350(0) win 5840 <mss 1460,sackOK,timestamp 4476392 0,nop,wscale 9> 22:23:48.740453 IP 172.16.100.142.http > 10.0.3.232.3845: S 1184231461:1184231461(0) ack 3133342351 win 5792 <mss 1460,sackOK,timestamp 184169723 4475642,nop,wscale 7> 22:23:49.537982 IP 172.16.100.142.http > 10.0.3.232.3845: S 1184231461:1184231461(0) ack 3133342351 win 5792 <mss 1460,sackOK,timestamp 184169923 4475642,nop,wscale 7> 22:23:49.538478 IP 10.0.3.232.3845 > 172.16.100.142.http: . ack 1 win 12 <nop,nop,timestamp 4476591 184169923> 22:23:49.538716 IP 10.0.3.232.3845 > 172.16.100.142.http: P 1:6(5) ack 1 win 12 <nop,nop,timestamp 4476591 184169923> 22:23:49.538730 IP 172.16.100.142.http > 10.0.3.232.3845: . ack 6 win 46 <nop,nop,timestamp 184169923 4476591> 22:23:49.539463 IP 172.16.100.142.http > 10.0.3.232.3845: P 1:98(97) ack 6 win 46 <nop,nop,timestamp 184169923 4476591> 22:23:49.539509 IP 172.16.100.142.http > 10.0.3.232.3845: F 98:98(0) ack 6 win 46 <nop,nop,timestamp 184169923 4476591> 22:23:49.539793 IP 10.0.3.232.3845 > 172.16.100.142.http: . ack 98 win 12 <nop,nop,timestamp 4476591 184169923> 22:23:49.540470 IP 10.0.3.232.3845 > 172.16.100.142.http: F 6:6(0) ack 99 win 12 <nop,nop,timestamp 4476591 184169923> 22:23:49.540483 IP 172.16.100.142.http > 10.0.3.232.3845: . ack 7 win 46 <nop,nop,timestamp 184169923 4476591> here is the result of lsmod bash-3.1# lsmod Module Size Used by Not tainted iptable_nat 5764 1 nf_nat_sip 4352 0 nf_nat_h323 6400 0 nf_nat_pptp 3200 0 nf_nat_proto_gre 2436 1 nf_nat_pptp nf_nat_ftp 2944 0 nf_nat 15020 6 iptable_nat,nf_nat_sip,nf_nat_h323,nf_nat_pptp,nf_nat_proto_gre,nf_nat_ftp xt_TPROXY 2688 1 xt_socket 2944 1 xt_MARK 2304 1 nf_tproxy_core 3712 2 xt_TPROXY,xt_socket,[permanent] iptable_mangle 2560 1 xt_CONNMARK 2560 0 iptable_filter 2432 1 ip_tables 10452 3 iptable_nat,iptable_mangle,iptable_filter nf_hipac 156168 0 noarp 20780 0 e100 29964 0 e1000 170688 0 iptables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:http TPROXY redirect 0.0.0.0:80mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK set 0x1 ACCEPT all -- anywhere anywhere